\n<\/p>\n
Italy\u2019s data protection watchdog has laid out what OpenAI needs to do for it to lift an order against ChatGPT issued at the end of last month<\/a> \u2014 when it said it suspected the AI chatbot service was in breach of the EU\u2019s General Data Protection Regulation (GDPR) and ordered the U.S.-based company to stop processing locals\u2019 data.<\/p>\n The EU\u2019s GDPR applies whenever personal data is processed, and there\u2019s no doubt large language models such as OpenAI\u2019s GPT have hoovered up vast amounts of the stuff off the public internet in order to train their generative AI models to be able to respond in a human-like way to natural language prompts.<\/p>\n OpenAI responded to the Italian data protection authority\u2019s order by swiftly geoblocking access to ChatGPT<\/a>. In a brief public statement, OpenAI CEO Sam Altman also tweeted<\/a> confirmation it had ceased offering the service in Italy \u2014 doing so alongside the usual Big Tech boilerplate caveat that it \u201cthink[s] we are following all privacy laws.\u201d<\/p>\n Italy\u2019s Garante evidently takes a different view.<\/p>\n The short version of the regulator\u2019s new compliance demand is this: OpenAI will have to get transparent and publish an information notice detailing its data processing; it must immediately adopt age gating to prevent minors from accessing the tech and move to more robust age verification measures; it needs to clarify the legal basis it\u2019s claiming for processing people\u2019s data for training its AI (and cannot rely on performance of a contract \u2014 meaning it has to choose between consent or legitimate interests); it also has to provide ways for users (and non-users) to exercise rights over their personal data, including asking for corrections of disinformation generated about them by ChatGPT (or else have their data deleted); it must also provide users with an ability to object to OpenAI\u2019s processing of their data for training its algorithms; and it must conduct a local awareness campaign to inform Italians that its processing their information to train its AIs.<\/p>\n The DPA has given OpenAI a deadline \u2014 of April 30 \u2014 to get most of that done. (The local radio, TV and internet awareness campaign has a slightly more generous timeline of May 15 to be actioned.)<\/p>\n There\u2019s also a little more time for the additional requirement to migrate from the immediately required (but weak) age gating child safety tech to a harder-to-circumvent age verification system. OpenAI has been given until May 31 to submit a plan for implementing age verification tech to filter out users below age 13 (and users aged 13 to 18 who had not obtained parental consent) \u2014 with the deadline for having that more robust system in place set at September 30.<\/p>\n In a press release<\/a> detailing what OpenAI must do in order for it to lift the temporary suspension on ChatGPT, ordered two weeks ago when the regulator announced it was commencing a formal investigation of suspected GDPR breaches, it writes:<\/p>\n OpenAI will have to comply by 30 April with the measures set out by the Italian SA [supervisory authority] concerning transparency, the right of data subjects \u2014 including users and non-users \u2014 and the legal basis of the processing for algorithmic training relying on users\u2019 data. Only in that case will the Italian SA lift its order that placed a temporary limitation on the processing of Italian users\u2019 data, there being no longer the urgency underpinning the order, so that ChatGPT will be available once again from Italy.<\/p>\n<\/blockquote>\n Going into more detail on each of the required \u201cconcrete measures,\u201d the DPA stipulates that the mandated information notice must describe \u201cthe arrangements and logic of the data processing required for the operation of ChatGPT along with the rights afforded to data subjects (users and non-users),\u201d adding that it \u201cwill have to be easily accessible and placed in such a way as to be read before signing up to the service.\u201d<\/p>\n Users from Italy must be presented with this notice prior to signing up and also confirm they are over 18, it further requires. While users who registered prior to the DPA\u2019s stop-data-processing order will have to be shown the notice when they access the reactivated service and must also be pushed through an age gate to filter out underage users.<\/p>\n On the legal basis issue attached to OpenAI\u2019s processing of people\u2019s data for training it\u2019s algorithms, the Garante has narrowed the available options down to two: consent or legitimate interests \u2014 stipulating that it must immediately remove all references to performance of a contract \u201cin line with the [GDPR\u2019s] accountability principle.\u201d (OpenAI\u2019s privacy policy<\/a> currently cites all three grounds but appears to lean most heavily on performance of a contract for providing services like ChatGPT.)<\/p>\n \u201cThis will be without prejudice to the exercise the SA\u2019s investigation and enforcement powers in this respect,\u201d it adds, confirming it is withholding judgment on whether the two remaining grounds can be used lawfully for OpenAI\u2019s purposes too.<\/p>\n Additionally, the GDPR provides data subjects with a suite of access rights, including a right to corrections or deletion of their personal data. Which is why the Italian regulator has also demanded that OpenAI implements tools so that data subjects \u2014 which means both users and non-users \u2014 can exercise their rights and get falsities the chatbot generates about them rectified. Or, if correcting AI-generated lies about named individuals is found to be \u201ctechnically unfeasible,\u201d the DPA stipulates the company must provide a way for their personal data to be deleted.<\/p>\n \u201cOpenAI will have to make available easily accessible tools to allow non-users to exercise their right to object to the processing of their personal data as relied upon for the operation of the algorithms. The same right will have to be afforded to users if legitimate interest is chosen as the legal basis for processing their data,\u201d it adds, referring to another of the rights GDPR affords data subjects when legitimate interest is relied upon as the legal basis for processing personal data.<\/p>\n All of the measures the Garante has announced are contingencies, based on its preliminary concerns. And its press release notes that its formal inquiries \u2014 \u201cto establish possible infringements of the legislation\u201d \u2014 carry on and could lead to it deciding to take \u201cadditional or different measures if this proves necessary upon completion of the fact-finding exercise under way.\u201d<\/p>\n We reached out to OpenAI for a response but the company had not replied to our email at press time.<\/p>\n<\/p><\/div>\n\n